CVE-2026-64861Disclosure

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

Back to dashboard

0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-07-24); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets1 URL

By indicator

https://undercodetesting.com/graphql-alias-flooding-how-a-single-request-with-7000-aliases-took-down-a-12-core-server-cve-2026-64861-deep-dive-video/

Classification over time

Date	Total	Labels

2026-07-24	1	Disclosure1
2026-07-28	1	General1

Full discourse2 posts

Muthu D@_anonysm91d
Disclosure
Got my first CVE today 🎉 Found a DoS bug in @getprobo's GraphQL API — no alias/depth/complexity limits, so a single query with 7,000 aliases just... went through. 300 parallel requests spiked CPU to 1033% and memory 10x. now officially CVE-2026-64861 #CVE #GraphQL #BugBounty https://t.co/dnTEcs7AJW
Post summary
The author reports discovering a denial‑of‑service vulnerability in getprobo’s GraphQL API, with no limits on aliases, depth, or complexity, leading to extreme CPU and memory usage.
01054122.7K
2.2K followersView on X
UNDERCODE TESTING@UndercodeUpdate86d
General
🚨 GraphQL Alias Flooding: How a Single Request with 7,000 Aliases Took Down a 12-Core Server — #CVE-2026-64861 Deep Dive + Video https://undercodetesting.com/graphql-alias-flooding-how-a-single-request-with-7000-aliases-took-down-a-12-core-server-cve-2026-64861-deep-dive-video/ Educational Purposes!
Post summary
The post announces a deep‑dive video on a GraphQL alias flooding vulnerability that caused a denial of service, but it provides no concrete PoC, exploit code, or evidence of active exploitation.
0001048
672 followersView on X

Explore more

Back to dashboard